<?php
declare(strict_types=1);

namespace Unsupervised\Schedular\Auth;

/**
 * Enforces the pending state of self-signup accounts:
 * - an account whose email is not yet confirmed cannot log in at all;
 * - a confirmed-but-unapproved account may log in, but its booking capability
 *   is withheld so it only reaches the "awaiting approval" screen.
 *
 * Both checks key solely off the pending user meta, so invite- and
 * admin-created students (which carry none of it) are unaffected.
 */
class RegistrationLoginGate {

	public function register(): void {
		add_filter( 'wp_authenticate_user', [ $this, 'blockUnconfirmed' ], 10, 1 );
		add_filter( 'user_has_cap', [ $this, 'withholdBookingWhilePending' ], 10, 4 );
	}

	/**
	 * Block authentication for a self-signup that has not yet confirmed its
	 * email. Runs after password verification.
	 *
	 * @param \WP_User|\WP_Error $user Authenticating user, or an earlier error.
	 * @return \WP_User|\WP_Error
	 */
	public function blockUnconfirmed( $user ) {
		if (
			$user instanceof \WP_User
			&& RegistrationStatus::isAwaitingApproval( (int) $user->ID )
			&& ! RegistrationStatus::emailConfirmed( (int) $user->ID )
		) {
			return new \WP_Error(
				'us_email_unconfirmed',
				esc_html__( 'Please confirm your email address before logging in — check your inbox for the confirmation link.', 'unsupervised-schedular' )
			);
		}

		return $user;
	}

	/**
	 * Strip the booking capability from any account still awaiting approval, so a
	 * confirmed-but-unapproved student cannot book until a studio admin approves.
	 *
	 * @param array<string, bool> $allcaps All capabilities currently held.
	 * @param array<int, string>  $caps    Required capabilities (unused).
	 * @param array<int, mixed>   $args    Callback args (unused).
	 * @param mixed               $user    The user being checked (a WP_User in practice).
	 * @return array<string, bool>
	 */
	public function withholdBookingWhilePending( array $allcaps, array $caps, array $args, mixed $user ): array {
		if ( $user instanceof \WP_User && RegistrationStatus::isAwaitingApproval( (int) $user->ID ) ) {
			unset( $allcaps[ RoleManager::CAP_BOOK_LESSON ] );
		}

		return $allcaps;
	}
}